nrf_security: Refactor Cracen IKG keys #18796
Open
+184
−46
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
the
changelog-entry-required
CI InformationTo view the history of this post, clich the 'edited' button above Inputs:Sources:sdk-nrf: PR head: f92ecb427a23aa57baf3050b8224d43401f6a54b more detailssdk-nrf:
Github labels
List of changed files detected by CI (5)Outputs:ToolchainVersion: b77d8c1312 Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped;
|
tomi-font
reviewed
Nov 12, 2024
tomi-font
requested changes
Nov 12, 2024
subsys/nrf_security/src/drivers/cracen/cracenpsa/src/key_management.c
Outdated
Show resolved
Hide resolved
subsys/nrf_security/src/drivers/cracen/cracenpsa/src/key_management.c
Outdated
Show resolved
Hide resolved
subsys/nrf_security/src/drivers/cracen/cracenpsa/src/platform_keys/platform_keys.c
Show resolved
Hide resolved
subsys/nrf_security/src/drivers/cracen/cracenpsa/src/platform_keys/platform_keys.c
Outdated
Show resolved
Hide resolved
|
This pull request has been marked as stale because it has been open (more than) 30 days with no activity. Remove the stale label or add a comment saying that you would like to have the label removed otherwise this pull request will automatically be closed in 7 days. Note, that you can always re-open a closed pull request at any time. |
Vge0rge
force-pushed
the
ikg_key_refactor_fix
branch
from
9e37e74 to
50361eb
Compare
Vge0rge
force-pushed
the
ikg_key_refactor_fix
branch
from
50361eb to
4ba3abc
Compare
This refactors how we handle the IKG key IDs for Cracen. Before this change we used the internal Cracen IKG key identifiers inside the builtin key driver. This had an issue because both the KMU keys and the IKG internal key IDs share the IDs 0-2. To avoid this collision the IKG handling is refactored to use the reserved Cracen PSA key identifiers in the driver level and only use the internal key intentifiers deeper in the implementation in order to avoid the conflicts. This also removes unused structs related to the IKG keys and unused code as well. Signed-off-by: Georgios Vasilakis <[email protected]>
Vge0rge
force-pushed
the
ikg_key_refactor_fix
branch
from
4ba3abc to
f92ecb4
Compare
tomi-font
reviewed
Dec 30, 2024
| static bool cracen_is_ikg_key(const psa_key_attributes_t *attributes) | ||
| { | ||
| #if CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS | ||
| return cracen_platform_keys_is_ikg_key(attributes) ? true : false; |
There was a problem hiding this comment.
Suggested change
| return cracen_platform_keys_is_ikg_key(attributes) ? true : false; | |
| return cracen_platform_keys_is_ikg_key(attributes); |
| { | ||
| if (PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)) == | ||
| PSA_KEY_LOCATION_CRACEN) { | ||
| return cracen_get_ikg_opaque_size(attributes); |
There was a problem hiding this comment.
Seems like you forgot to update this reference?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This fixes an issue where the KMU keys 0-2 on the nRF54L15 cannot be used to store keys.
This refactors how we handle the IKG key IDs for
Cracen. Before this change we used the internal
Cracen IKG key identifiers inside the builtin key
driver. This had an issue because both the KMU keys and the IKG internal key IDs share the IDs 0-2.
To avoid this collision the IKG handling is refactored to use the reserved Cracen PSA key identifiers in the driver level and only use the internal key intentifiers deeper in the implementation in order to avoid the conflicts.
This also removes unused structs related to the IKG keys and unused code as well.